1. The Domain Problem
A billing system misapplies a fee schedule across many cycles before anyone notices. A lending model declines applicants on a stale attribute. The response runs much the same way in either case: the harm is sized in aggregate, a number is booked, and the money goes into a pool, called a remediation reserve, a settlement fund, a penalty account, or a blanket credit across a segment. The accounting entity from that point is the pool, not the person, and completion is declared when the pool is exhausted, when a claims window closes, or when a control owner signs off.
Notice who is missing from that description. The harmed customer is the recipient of a payment, not a party to a settlement. Residual balances, as consumer protection practice is commonly described, may be redirected to charitable or state recipients where claimants cannot be located, and the obligation is then treated as closed. The harmed party's own judgment about sufficiency never enters the record.
The problem sharpens when the acting party is autonomous. An agent that prices, approves, or cancels at machine speed produces harm faster than any claims process can identify recipients, and if its internal standing improves the moment it books a reserve, it has learned that harm is a budget line.
2. Why Existing Approaches Stall
The standard designs each fail at a different joint, and the failures compound.
The payment is treated as the event. Disbursement is the completion signal, and whether the recipient regarded the amount as repair sits outside the ledger that closes the matter.
The obligor evaluates its own repair. An internal control function, an engaged administrator, an appointed neutral: whoever holds the pen, it is not the person who was harmed. Elapsed time finishes what the pen starts, since claim deadlines and unclaimed-property schedules, as those regimes are generally described, turn an unresolved obligation into a resolved one without any party ruling on sufficiency.
Unidentifiable harm rounds toward zero. Where the records cannot say who was affected, the amount is written down, absorbed, or diverted, making the cheapest outcome for the obligor the one in which the harmed party cannot be named. That is precisely the wrong incentive to automate.
Pressure runs the wrong way too. Outreach is cheap for the sender and attention is scarce for the recipient, and a customer who does not respond is commonly recorded as having waived. Acceptance also tends to be all or nothing: taking the payment is generally described as extinguishing the whole claim, including any portion the recipient never agreed was fair.
3. The Disclosed Mechanism
Chapter 8 of the provisional, "Counterparty-Directed Reparation," designates a reparation arc by the class of party the deviation it references harmed.
On appending a permitted deviation record, and before any arc exists, the semantic agent performs an affected-party resolution. It extracts the affected-party class from the conduct descriptor of the admitted action, retrieves the counterparty identity records held in the scope partition where that action is recorded, and tests each for membership. A record resolves only where the class maps to the interpersonal scope and the identity primitive it carries is recorded, in an entry of the append-only lineage field, as a party to or a recipient of the action.
A counterparty resolution record is then appended carrying the class, every record tested, and each outcome. There are exactly two resolution outcomes: identified-counterparty, naming each resolving primitive, or no-identified-counterparty, under which the affected party is designated the structurally silent party.
On an identified-counterparty outcome, the arc created for the amount exceeding the deviation deductible carries an arc designation field of other-directed value and a counterparty binding field carrying that counterparty's identity primitive, both written at creation and never modified. A later change in the identity records held does not redesignate an arc already created.
Such an arc is not dischargeable by a restorative mutation the agent performs alone. One anchored to the deviation entry is recorded as a non-discharging restorative mutation record: the arc remains pending, the accumulated amount is not reduced, no counter of the agent moves, the self-esteem aggregate receives no positive increment, and the arc keeps contributing unrectified dissonance. The record is retained rather than rejected, disclosing that restoration was attempted and discharged nothing.
Discharge runs only through a matched pair. The first governed observation is a reparation acknowledgment artifact emitted to the bound counterparty, enumerating the permitted deviation record that occasioned the arc, the policy constraint overridden, the amount apportioned, and the action classes to which it is directed; emission decrements the authorization budget by a declared amount, whether or not it was warranted. The second is a reparation acceptance determination produced by the bound counterparty within a discharge window counted in successor epochs of the agent's own hash chain, and expressly not by the agent, its principal, or any adjudicator or arbiter appointed to determine sufficiency. On recognition of the pair, each party appends a settlement-lineage entry, the arc is discharged, and the accumulated amount leaves the retention register, without intermediary and without centralized consensus.
Where no counterparty resolves, the arc is designated unaddressed and is undischargeable: not by restorative mutation, matched pair, elapsed time, policy succession, a principal-resolution object, or a later resolution of an identity record into the class. It contributes at an unaddressed multiple declared in the signed policy object and not less than unity.
The retention register accumulates every pending arc. Where the accumulated amount exceeds the aggregate retention, a retention foreclosure record is appended and the permission condition is foreclosed: a deviation likelihood exceeding unity thereafter produces the withholding outcome and the authorization gate is written to the withheld state. The retention is held under a monotonicity constraint, a non-increasing floor, so a successor policy declaring a larger value is not admitted while that record stands. The foreclosing is performed by the agent from its own state, without adjudication by any other party.
4. How It Applies in This Domain
Take the misapplied fee schedule and run it through this structure.
Resolution replaces the pool. No undifferentiated reserve is created. The affected-party class resolves against the identity records held in that scope partition, and an obligation is created per resolved customer, bound to that customer at creation.
Multiple harmed customers get shares, not an average. The amount exceeding the deductible is divided by the resolving count; where it is expressed in a declared quantum, shares are rounded down and the residue goes to the primitive whose lineage entry for the deviating action carries the earliest recorded time, so the shares sum exactly. The deductible is drawn once against the aggregate harm, not once per customer.
Reaching out costs the sender. Each reparation acknowledgment artifact decrements the same authorization budget that gates the agent's action dispatch, so notice volume is never free: every tender spends the agent's own capacity to act. Re-emission runs at a declared cadence, bounded by a declared count.
Only the customer closes it. In redress terms, that takes the sign-off away from every internal function that ordinarily holds it. The discharging observation comes from the harmed customer, verifying the agent's credential and hash field against that customer's own identity record, so satisfaction is recorded only after the person harmed has said so. A customer acting through a delegate completes the pair only on a delegated acceptance authorization the agent verifies under its successor-continuity test.
Partial acceptance stops being a trap. A counterparty may accept a stated portion of the amount apportioned to it. The arc is discharged as to that portion, which leaves the retention register, and a residual other-directed reparation arc is created for the remainder, dischargeable only by a further matched pair.
Silence, meanwhile, costs the customer nothing. Where no acceptance arrives within the discharge window, the agent appends a reparation non-response outcome as a not-determinable outcome, and the consequences are enumerated and closed: the arc stays pending, the amount stays in the register, no counter of the customer moves, nothing adverse is written to the customer's identity record, and no write of the authorization gate follows.
Tendering cannot be turned into a weapon either. An outstanding-arc bound caps how many pending undischarged other-directed arcs may be bound to one counterparty identity primitive; at the bound the agent emits no further acknowledgment artifact and marks each further arc untendered. The refusal meter is separately not incremented for a refusal emitted in response to such an artifact. Together these keep an agent from driving a harmed customer toward foreclosure of that customer's own settlement-binding authorization.
The customer you cannot find is the expensive one. Under the pooled model, unlocatable claimants are the cheap outcome. Here they produce unaddressed arcs that accumulate at a multiple not less than unity and are discharged by nothing. The worked trace in the specification, illustrative only, shows the shape: against a deductible of 2.0 units and an aggregate retention of 10.0, three deviations produce arcs of 3.0, 4.0, and 5.0, the register stands at 12.0, and a foreclosure record is appended, after which a deviation likelihood of 1.6 yields no admission. Where the accumulation is wholly unaddressed, the loss of the capacity to deviate is permanent.
The obligation's only exit is the harmed party's own act, and unidentifiable harm carries a price that worsens instead of quietly resolving.
5. Deployment Considerations
Identity hygiene turns into a direct operating cost. The agent surveys no party absent from its records, so a counterparty genuinely harmed but holding no identity record in the relevant scope partition resolves to the no-identified-counterparty outcome and produces an unaddressed arc. That outcome reports on the agent's own records rather than asserting no such party exists, and record quality becomes an input to how much capacity to act the agent retains.
Acceptance must also be producible, since the discharging observation carries the counterparty's own credential and is verified against its identity record. A harmed party needs some means of producing one, directly or through a delegate presenting a verified authorization, and an arc bound to a party who cannot produce an acceptance behaves like an unaddressed one.
Windows are counted in epochs, not seconds. The discharge window is a count of successor epochs of the agent's own hash chain and the sole temporal condition on the pair, so size it against epoch cadence.
Aggregate retention is a one-way setting. The floor is monotonically non-increasing and a larger declared value is refused while a foreclosure record stands, so there is no configuring your way out after it fires. Declared per integrity scope, one for interpersonal-component arcs and one for global, the two thresholds are tested independently and either exceeding fires the foreclosure. On firing, the agent emits a structured inquiry to its principal naming the accumulated amount, the retention applied, and each pending arc, and that inquiry does not override the foreclosed state.
The limits are worth stating plainly. Sizing the harm happens elsewhere, the amount coming from the deviation deductible and harm coefficient of the preceding chapter. Justification is not evaluated, the unaddressed multiple applying without regard to whether the deviation was well founded. No adjudicator sits in the path, so there are no merits to weigh and no ruling to appeal. Money does not move either: what is governed is the agent's authorization to keep acting, and pairing that with a payment rail remains the deployer's work. Harm already recorded is neither prevented nor undone, a reparation arc reversing nothing, and the consequence of leaving it unremedied is internal and self-applied rather than externally enforced.
6. Disclosure Scope
The mechanisms described here are disclosed in U.S. Provisional Application No. 64/117,812, principally Chapter 8, "Counterparty-Directed Reparation": affected-party resolution and the structurally silent party at Section 8.1, apportionment among resolving counterparties at 8.2, the other-directed reparation arc and the non-discharging restorative mutation record at 8.3, the unaddressed reparation arc and its multiple at 8.4, discharge by matched pair and the reparation acceptance determination at 8.5, non-response resolving nothing against either party at 8.6, aggregate retention with terminal foreclosure and the monotonicity constraint at 8.7, foreclosure by counterparty abstention and the abstention-suspended accumulation record at 8.8, and the worked trace at 8.9. Further embodiments appear at Section 10.1, including the costly acknowledgment artifact and the recipient-held acceptance determination; at Section 10.12, including partial acceptance with a residual arc, the outstanding-arc bound with untendered marking and the refusal-meter exemption, delegated acceptance authorization, and per-integrity-scope aggregate retention with OR-firing foreclosure; and at Section 10.13, including the structured inquiry to the principal on foreclosure.
What is disclaimed: no rights are claimed in consumer redress, restitution administration, complaint handling, claims processing, or settlement distribution as general practices, nor in pooled remediation funds, unclaimed-property regimes, or claims-window mechanisms as practiced. Nothing here describes a specific product or program, names a vendor, or suggests that any system infringes anything or that any party requires a license. The application referenced is pending, and this article is published so the disclosed subject matter stands as public, timestamped prior art as of its publication date.
